Skip to content

Commit 2d21eb0

Browse files
danmardanmar
committed
Cleaned up snprintf hardcoding in CheckBufferOverrun
1 parent a6cfd15 commit 2d21eb0

6 files changed

Lines changed: 13 additions & 109 deletions

File tree

‎cfg/std.cfg‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5298,6 +5298,11 @@
52985298
<noreturn>false</noreturn>
52995299
<leak-ignore/>
53005300
<formatstr/>
5301+
<arg nr="1">
5302+
<not-null/>
5303+
<minsize type="argvalue" arg="2"/>
5304+
<minsize type="strlen" arg="3"/>
5305+
</arg>
53015306
<arg nr="2">
53025307
<not-uninit/>
53035308
</arg>

‎lib/checkbufferoverrun.cpp‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -692,14 +692,6 @@ void CheckBufferOverrun::checkScope(const Token *tok, const std::vector<std::str
692692
}
693693
}
694694

695-
// snprintf..
696-
const std::string snprintfPattern = declarationId > 0 ? std::string("snprintf ( %varid% , %num% ,") : ("snprintf ( " + varnames + " , %num% ,");
697-
if (Token::Match(tok, snprintfPattern.c_str(), declarationId)) {
698-
const MathLib::bigint n = MathLib::toLongNumber(tok->strAt(4 + varcount));
699-
if (n > total_size)
700-
outOfBoundsError(tok->tokAt(4 + varcount), "snprintf size", true, n, total_size);
701-
}
702-
703695
// Check function call..
704696
if (Token::Match(tok, "%name% (")) {
705697
// No varid => function calls are not handled
@@ -973,13 +965,6 @@ void CheckBufferOverrun::checkScope(const Token *tok, const ArrayInfo &arrayInfo
973965
tok2 = tok2->tokAt(7);
974966
}
975967
}
976-
977-
// snprintf..
978-
if (total_size > 0 && Token::Match(tok, "snprintf ( %varid% , %num% ,", declarationId)) {
979-
const MathLib::bigint n = MathLib::toLongNumber(tok->strAt(4));
980-
if (n > total_size)
981-
outOfBoundsError(tok->tokAt(4), "snprintf size", true, n, total_size);
982-
}
983968
}
984969
}
985970
}

‎samples/outOfBounds/bad.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,5 @@
22
int main()
33
{
44
char str[5];
5-
snprintf(str, 10, "%s", "abc");
5+
snprintf(str, 10, "%s", "0123456789abcdef");
66
}

‎samples/outOfBounds/out.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
[samples\outOfBounds\bad.c:5]: (error) snprintf size is out of bounds: Supplied size 10 is larger than actual size 5.
1+
[samples\outOfBounds\bad.c:5]: (error) Buffer is accessed out of bounds: str

‎test/cfg/std.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@ void bufferAccessOutOf(void) {
1616
fgets(a,5,stdin);
1717
// cppcheck-suppress bufferAccessOutOfBounds
1818
fgets(a,6,stdin);
19+
sprintf(a, "ab%s", "cd");
20+
// cppcheck-suppress bufferAccessOutOfBounds
21+
sprintf(a, "ab%s", "cde");
22+
snprintf(a, 5, "abcde%i", 1);
23+
// cppcheck-suppress bufferAccessOutOfBounds
24+
snprintf(a, 6, "abcde%i", 1);
1925
strcpy(a,"abcd");
2026
// cppcheck-suppress bufferAccessOutOfBounds
2127
strcpy(a, "abcde");

‎test/testbufferoverrun.cpp‎

Lines changed: 0 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -209,13 +209,6 @@ class TestBufferOverrun : public TestFixture {
209209
TEST_CASE(pointer_out_of_bounds_2);
210210
TEST_CASE(pointer_out_of_bounds_sub);
211211

212-
TEST_CASE(snprintf1);
213-
TEST_CASE(snprintf2);
214-
TEST_CASE(snprintf4);
215-
TEST_CASE(snprintf5);
216-
TEST_CASE(snprintf6);
217-
TEST_CASE(snprintf7);
218-
219212
TEST_CASE(strncat1);
220213
TEST_CASE(strncat2);
221214
TEST_CASE(strncat3);
@@ -2893,91 +2886,6 @@ class TestBufferOverrun : public TestFixture {
28932886
ASSERT_EQUALS("[test.cpp:4]: (portability) Undefined behaviour, when 'i' is -20 the pointer arithmetic 'x-i' is out of bounds.\n", errout.str());
28942887
}
28952888

2896-
void snprintf1() {
2897-
check("void f()\n"
2898-
"{\n"
2899-
" char str[5];\n"
2900-
" snprintf(str, 10, \"%s\", \"abc\");\n"
2901-
"}");
2902-
ASSERT_EQUALS("[test.cpp:4]: (error) snprintf size is out of bounds: Supplied size 10 is larger than actual size 5.\n", errout.str());
2903-
}
2904-
2905-
void snprintf2() {
2906-
check("void f()\n"
2907-
"{\n"
2908-
" char str[5];\n"
2909-
" snprintf(str, 5, \"%s\", \"abc\");\n"
2910-
"}");
2911-
ASSERT_EQUALS("", errout.str());
2912-
}
2913-
2914-
void snprintf4() {
2915-
check("void f(int x)\n"
2916-
"{\n"
2917-
" char str[5];\n"
2918-
" snprintf(str, 8 - x, \"abcdefghijkl\");\n"
2919-
"}");
2920-
ASSERT_EQUALS("", errout.str());
2921-
}
2922-
2923-
void snprintf5() {
2924-
check("struct Foo { char a[1]; };\n"
2925-
"void f()\n"
2926-
"{\n"
2927-
" struct Foo x;\n"
2928-
" snprintf(x.a, 2, \"aa\");\n"
2929-
"}");
2930-
ASSERT_EQUALS("[test.cpp:5]: (error) snprintf size is out of bounds: Supplied size 2 is larger than actual size 1.\n", errout.str());
2931-
2932-
// This is out of bounds if 'sizeof(ABC)' is 1 (No padding)
2933-
check("struct Foo { char a[1]; };\n"
2934-
"void f()\n"
2935-
"{\n"
2936-
" struct Foo *x = malloc(sizeof(Foo));\n"
2937-
" snprintf(x.a, 2, \"aa\");\n"
2938-
" free(x);\n"
2939-
"}");
2940-
TODO_ASSERT_EQUALS("error", "", errout.str());
2941-
2942-
check("struct Foo { char a[1]; };\n"
2943-
"void f()\n"
2944-
"{\n"
2945-
" struct Foo *x = malloc(sizeof(Foo) + 10);\n"
2946-
" snprintf(x.a, 2, \"aa\");\n"
2947-
" free(x);\n"
2948-
"}");
2949-
ASSERT_EQUALS("", errout.str());
2950-
}
2951-
2952-
void snprintf6() {
2953-
check("struct Foo { char a[3]; };\n"
2954-
"void f()\n"
2955-
"{\n"
2956-
" struct Foo x;\n"
2957-
" snprintf(x.a, 2, \"aa\");\n"
2958-
"}");
2959-
ASSERT_EQUALS("", errout.str());
2960-
}
2961-
2962-
void snprintf7() {
2963-
check("void x() {\n"
2964-
" sal_Char pString[1024];\n"
2965-
" snprintf(pString, 1024, \"ab\");\n"
2966-
"}");
2967-
ASSERT_EQUALS("", errout.str());
2968-
2969-
// #6141 FP: Unknown type is assumed to have size 0
2970-
check("typedef struct {\n"
2971-
" CHAR s[42];\n"
2972-
"} sct_t;\n"
2973-
"void foo() {\n"
2974-
" sct_t p;\n"
2975-
" snprintf(p.s, 42, \"abcdef\");\n"
2976-
"}\n");
2977-
ASSERT_EQUALS("", errout.str());
2978-
2979-
}
2980-
29812889
void strncat1() {
29822890
checkstd("void f(char *a, char *b) {\n"
29832891
" char str[16];\n"

0 commit comments

Comments
 (0)